CVE-2026-27238 is a heap-based buffer overflow vulnerability affecting Adobe InDesign Desktop versions 20.5.2, 21.2, and earlier. The vulnerability allows for arbitrary code execution in the context of the current user upon opening a malicious file, requiring user interaction. The CVSS 3.1 base score is 7.8, indicating high severity with local attack vector, low attack complexity, no privileges required, and user interaction needed. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation could lead to arbitrary code execution with the privileges of the current user, potentially compromising the affected system. The attack requires the victim to open a malicious file, limiting the attack vector to user interaction scenarios. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources. Monitor Adobe's security advisories for updates regarding patches or mitigations.